diff --git a/bootstrap/sops/CREDENTIALS.md b/bootstrap/sops/CREDENTIALS.md
index eec4aa9..a13ece8 100644
--- a/bootstrap/sops/CREDENTIALS.md
+++ b/bootstrap/sops/CREDENTIALS.md
@@ -58,8 +58,20 @@ kubectl kustomize platform/<component> >/dev/null && git add -A && git commit
 | `oauth2-proxy-credentials` | `oauth2-proxy` | `client-id`, `client-secret`, `cookie-secret` ⚠️verify chart keys | oauth2-proxy forward-auth | 6 | `oauth2-proxy-credentials.yaml.example` |
 | `pia-credentials` | *(Phase-3 VPN ns, TBA)* | `username`, `password` | Gluetun VPN egress (protocol ≠ TCP) — **not wired yet** | 3 | `pia-credentials.yaml.example` |
 
-**Cloudflare token scope:** one API token with **Zone → DNS → Edit** + **Zone → Read** on the
-`keithjackson.dev` zone serves both cert-manager (DNS-01) and ExternalDNS. Same value in both namespace copies.
+**Cloudflare token — exact creation steps** (My Profile → API Tokens → Create Token → **Custom token**):
+one token serves both cert-manager (DNS-01 `_acme-challenge` TXT) and ExternalDNS (A/CNAME), same value
+in both namespace copies. In each Permissions row, the left dropdown defaults to **Account** — switch it
+to **Zone** (Account-scope groups like "Account DNS Settings"/"DNS Firewall"/"Registrar Domains" are the
+wrong scope and not needed). Set:
+
+| Scope | Group | Access |
+|---|---|---|
+| Zone | DNS  | Edit |
+| Zone | Zone | Read |
+
+- **Zone Resources:** Include → Specific zone → `keithjackson.dev`.
+- Leave Client-IP/TTL filtering blank → Continue to summary → Create Token → copy the value into the
+  `api-token` field of **both** `cloudflare-api-token` secret copies.
 
 ---